{"id":90583,"date":"2020-08-03T01:42:25","date_gmt":"2020-08-02T23:42:25","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/kriticheskaya-uyazvimost-v-wordpress-plagine-wpdiscuz-naschityvayushhem-80-tysyach-ustanovok"},"modified":"2020-08-03T01:42:25","modified_gmt":"2020-08-02T23:42:25","slug":"kriticheskaya-uyazvimost-v-wordpress-plagine-wpdiscuz-naschityvayushhem-80-tysyach-ustanovok","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/kriticheskaya-uyazvimost-v-wordpress-plagine-wpdiscuz-naschityvayushhem-80-tysyach-ustanovok","title":{"rendered":"Kriitiline haavatavus WordPressi pistikprogrammis wpDiscuz, millel on 80 000 installatsiooni.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>WordPressi pistikprogrammis <noindex><a rel=\"nofollow\" href=\"https:\/\/wordpress.org\/plugins\/wpdiscuz\/\">wpDiscuz<\/a><\/noindex>, mis on paigaldatud enam kui 80 000 veebisaidile, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.wordfence.com\/blog\/2020\/07\/critical-arbitrary-file-upload-vulnerability-patched-in-wpdiscuz-plugin\/\">tuvastatud<\/a><\/noindex> ohtlik haavatavus, mis v\u00f5imaldab autentsuseta \u00fcles laadida igasuguseid faile serverisse. Sealhulgas saab \u00fcles laadida PHP-faile ja kasutada oma koodi serveris t\u00e4itmiseks. Probleem puudutab versioone 7.0.0 kuni 7.0.4 (kaasas arvatud). Haavatavus on k\u00f5rvaldatud versioonis 7.0.5.<\/p>\n<p>wpDiscuz'i plugin v\u00f5imaldab AJAX-i abil kommentaaride d\u00fcnaamilist saatmist ilma lehte uuesti laadimata. Turvaauk tuleneb koodi ebat\u00e4psusest, mis kontrollib \u00fcles laaditud failit\u00fc\u00fcpe, mida kasutatakse kommentaaride juurde piltide lisamiseks. Juhuks, kui piirati suvaliste failide \u00fcleslaadimist, kutsuti v\u00e4lja MIME-t\u00fc\u00fcbi m\u00e4\u00e4ramise funktsioon sisu p\u00f5hjal, mida oli lihtne ringida, et laadida PHP-faile. Faililaiendit ei piiratud. N\u00e4iteks oli v\u00f5imalik laadida fail myphpfile.php, edastades alguses j\u00e4rjestuse 89 50 4E 47 0D 0A 1A 0A, mis identifitseerib PNG-pilte, ja seej\u00e4rel paigutada plokk &#171;&lt;?php&#187; koos PHP-koodiga.<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Allikas: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=53477\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 WordPress-\u043f\u043b\u0430\u0433\u0438\u043d\u0435 wpDiscuz, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d \u043d\u0430 \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c 80 \u0442\u044b\u0441\u044f\u0447\u0430\u0445 \u0441\u0430\u0439\u0442\u043e\u0432, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043e\u043f\u0430\u0441\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u043b\u044e\u0431\u043e\u0439 \u0444\u0430\u0439\u043b \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440. \u0412 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c PHP-\u0444\u0430\u0439\u043b\u044b \u0438 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0435 \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u044b \u0432\u0435\u0440\u0441\u0438\u0438 \u0441 7.0.0 \u043f\u043e 7.0.4 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0435 7.0.5. \u041f\u043b\u0430\u0433\u0438\u043d wpDiscuz \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f AJAX \u0434\u043b\u044f [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-90583","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.0.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412 WordPress-\u043f\u043b\u0430\u0433\u0438\u043d\u0435 wpDiscuz, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d \u043d\u0430 \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c 80 \u0442\u044b\u0441\u044f\u0447\u0430\u0445 \u0441\u0430\u0439\u0442\u043e\u0432,\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/news\/kriticheskaya-uyazvimost-v-wordpress-plagine-wpdiscuz-naschityvayushhem-80-tysyach-ustanovok\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.0.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 WordPress-\u043f\u043b\u0430\u0433\u0438\u043d\u0435 wpDiscuz, \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u043c 80 \u0442\u044b\u0441\u044f\u0447 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412 WordPress-\u043f\u043b\u0430\u0433\u0438\u043d\u0435 wpDiscuz, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d \u043d\u0430 \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c 80 \u0442\u044b\u0441\u044f\u0447\u0430\u0445 \u0441\u0430\u0439\u0442\u043e\u0432,\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/news\/kriticheskaya-uyazvimost-v-wordpress-plagine-wpdiscuz-naschityvayushhem-80-tysyach-ustanovok\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-08-02T23:42:25+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-08-02T23:42:25+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Kriitiline haavatavus WordPressi plugina wpDiscuz puhul, millel on 80 000 paigaldust | ProHoster","description":"WordPressi plugina wpDiscuz, mis on paigaldatud rohkem kui 80 000 veebilehele,","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/kriticheskaya-uyazvimost-v-wordpress-plagine-wpdiscuz-naschityvayushhem-80-tysyach-ustanovok","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 WordPress-\u043f\u043b\u0430\u0433\u0438\u043d\u0435 wpDiscuz, \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u043c 80 \u0442\u044b\u0441\u044f\u0447 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a | ProHoster","og:description":"\u0412 WordPress-\u043f\u043b\u0430\u0433\u0438\u043d\u0435 wpDiscuz, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d \u043d\u0430 \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c 80 \u0442\u044b\u0441\u044f\u0447\u0430\u0445 \u0441\u0430\u0439\u0442\u043e\u0432,","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/kriticheskaya-uyazvimost-v-wordpress-plagine-wpdiscuz-naschityvayushhem-80-tysyach-ustanovok","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-08-02T23:42:25+00:00","article:modified_time":"2020-08-02T23:42:25+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"90583","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:46:55","updated":"2022-09-27 17:43:54","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/90583","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=90583"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/90583\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=90583"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=90583"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=90583"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}